University of Surrey Reveals High-Value Fraud Vulnerabilities in Global Contactless Payments

A recent study led by the University of Surrey in collaboration with the University of Birmingham has uncovered significant security vulnerabilities in modern contactless payment systems that use the EMV standard, which underpins 90% of in-store card transactions globally. The research, presented at USENIX Security Symposium and DEFCON 2025, found that features added to enhance convenience—such as offline transaction capabilities, transit mode for quick barrier passage, and region-specific PIN input rules—have inadvertently introduced weaknesses exploited to perform unauthorized high-value transactions, including one instance of a fraudulent £25,000 payment. Researchers demonstrated how these complex and independently added features can interact to bypass safeguards, for example by tricking terminals into accepting physical cards when only mobile devices should be allowed or processing high-value payments without PIN or biometric checks. The study calls for better coordination among payment providers, card networks, and manufacturers to address these hidden cracks in the system and improve security without sacrificing convenience. Industry stakeholders have been informed and some fixes are underway, but experts emphasize ongoing collaboration is essential to close these gaps and protect consumers. Mastercard and Visa have been contacted for comments but no official responses were included in the findings.